Sets a Non-Standard SELinux Type

apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
  name: initcontainer-selinux-type
  annotations:
    kubeapt.io/uuid: "f73f5ff5-358d-4f0f-a299-de4e05d26ba1"
    security.kubeapt.io/displayName: "Sets a Non-Standard SELinux Type"
    security.kubeapt.io/description: "An SELinux type outside the container domains, such as spc_t or unconfined_t, drops the kernel confinement that stops an init container process from reading host files and reaching devices it does not own."
    security.kubeapt.io/resource: "InitContainers"
    security.kubeapt.io/severity: "Moderate"
    security.kubeapt.io/remediation: "Remove the seLinuxOptions.type setting from every init container, or replace it with one of container_t, container_init_t, container_kvm_t or container_engine_t. Field: spec.initContainers[*].securityContext.seLinuxOptions.type."
    security.kubeapt.io/product: "Kubernetes"
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
    - apiGroups:
      - ''
      apiVersions:
      - v1
      operations:
      - CREATE
      - UPDATE
      resources:
      - pods
  variables:
  - name: allowedSELinuxTypes
    expression: |
      ["container_t","container_init_t","container_kvm_t","container_engine_t"]
  validations:
  - expression: |
      !has(object.spec.initContainers) || object.spec.initContainers.all(ic,
        !has(ic.securityContext) ||
        !has(ic.securityContext.seLinuxOptions) ||
        !has(ic.securityContext.seLinuxOptions.type) ||
        ic.securityContext.seLinuxOptions.type == "" ||
        variables.allowedSELinuxTypes.exists(t, t == ic.securityContext.seLinuxOptions.type)
      )
    message: |
      spec.initContainers[*].securityContext.seLinuxOptions.type must be undefined, empty (""), or one of: container_t, container_init_t, container_kvm_t, container_engine_t.